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Amendments to the Specification 

Id the Specification : 

Please replace the paragraph beginning at page 13, line 3 with the following amended 
paragraph: 

Turning now to Fig. 14, four computers A, B, C, and D networked together are 
illustrated. Machines A, B and C had previously arrived at the state illustrated in Prior 
Art Fig. 10. Then, machine D came online and rather than announcing its presence via an 
ARP broadcast after waiting a random period of time, machine D employed an ARP 
probe and the method described above in connection with Figs. 12 and 13 to determine 
whether there was a duplicate IP address conflict problem. While conventional systems 
may similarly generate an ARP probe, such conventional systems may not attempt to 
determine whether they are connected to an active network and may not employ the 
random time delay before sending the ARP probe(s). Note that machine D has an IP 
address 1.2.3. 4 . 1.2.3.4 that is a duplicate of the IP address of machine A. However, the 
physical addresses (2233 and 1144) do not match. 

Please replace the paragraph beginning at page 22, line 12 with the following amended 
paragraph: 

A session layer 330 resides below the presentation layer 320 and once again the 
session layer 330 should similarly be unaware of the presence and/or functionality of an 
ARP component. The session layer 330 typically provides applications (e.g., in the 
application layer 310) with data streams oriented to a session user. A transport layer 340 
resides below the session layer 330. One example transport layer 340 employs TCP 
components that interact with IP components that reside in a network layer 350- The 
TCP components should be unaware of the ARP processing and should simply receive a 
stream of TCP Segments (e.g., 130 through 132, Prior Art Fig. 2) from IP components. 
The network layer 350 (e.g., the IP components), are aware of the ARP presence and 

2 

PAGE 2/16* RCVD AT 5/3112005 5:12:52 PM [Eastern Daylight Time) ' SVR:USPT0-EFXRF-1/6 ' DNiS:8729306 * CSID:216 696 8731 » DURATION (mm-ss):04-56 



05/31/2005 16:07 FAX 216 696 $731 



AMIN, & TUROCY LLP. 



©003 



09/965,267 01AB071 

functions because it is the translation of IP addresses to physical addresses with which the 
ARP components are concerned. Such translation is necessary because network layer 
components IP components) are conventionally associated with an IP addres ses 
address, (which is hopefully unique), but lower layers (e.g., a physical layer 370) are 
conventionally associated with a hard coded physical address. Thus the physical layer 
370 (e.g., an Ethernet layer) is aware of the ARP component presence and functions. The 
network layer 350 is employed in sending/receiving packets of data end to end from the 
source to the destination, over intermediate nodes if necessary- 
Please replace the paragraph beginning at page 24, line 1 with the following amended 
paragraph; 

Prior Art Fig. 6 illustrates a computer network 500 where three computers (A, B > 
C) are networked together. The networking involves ARP Cache tables (ARPCaches). 
Computer A is associated with an ARPCache 530, computer B is associated with an 
ARPCache 510 and computer C is associated with an ARPCache 520. At the point in 
time associated with Prior Art Fig. 6, the three computers have not yet communicated, 
and have not broadcast their IP/physical address resolved pairs, and thus the ARPCaches 
contain only the "static" addresses associated with the computers. Thus, the ARPCache 
530 contains the IP address 1.2.3.4 and its associated physical address 1 144. Similarly, 
the ARPCache 510 contains the DP address A.B.CD. A.B.CD and the associated 
physical address AADD and the ARPCache 520 contains the DP address 5.6.7.8 and the 
associated physical address 5588. It is to be appreciated that the IP addresses and 
physical addresses illustrated in the figures are merely representative and that actual IP 
addresses and/or physical addresses may have different formats from those illustrated. It 
can be seen that in such an initial state, machines know their own IP address and their 
own physical address (paddr). When the machines attempt to communicate via the 
network, the ARPCaches of the communicating machines will be updated. 
Conventionally, such updating is accomplished by employing ARP request/response 
pairs. 
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Thus, turning to Prior Art Fig. 7, a network 600 comprising three computers networked 
together (computer A, computer B, computer C) is illustrated The network 600 includes 
ARPCaches. Computer A is associated with an ARPCache 630, computer B is associated 
with an ARPCache 610 and computer C is associated with an ARPCache 620. At the 
point in time associated with Prior Art Fig. 7, the ARPCaches contain the "static" 
addresses associated with the computers. Thus, the ARPCache 630 contains the IP 
address 1.2.3.4 and its associated physical address 1144. Similarly, the ARPCache 610 
contains the IP address A.B.C.D. A.B.C.D and the associated physical address AADD 
and the ARPCache 620 contains the IP address 5.6.7.8 and the associated physical 
address 5588. In addition to the static addresses, machine A has broadcast its resolved 
IP/physical address pair onto the network by, for example, a conventional ARP 
broadcast. Thus, the ARPCache 610 includes the IP address 1 .2.3.4 and the associated 
physical address 1144, where the IP/physical address pair represents the resolved 
IP/physical address pair provided by machine A. Similarly, the ARPCache 620 includes 
the IP address 1 .2.3.4 and the associated physical address 1 144, where the IP/physical 
address pair represents the resolved IP/physical address pair provided by machine A. 
Updating ARPCaches when a machine attaches to a network using the broadcast method 
illustrated in Prior Ait Fig. 7 leads to potential duplicate IP address problems that are 
addressed by the present invention. 

Please replace the five paragraphs beginning at page 25, line 6 with the following 
amended paragraphs: 

Prior Art Fig. 8 illustrates a network 700 comprising three computers networked 
together (computer A, computer B, computer C). The network 700 includes ARPCaches. 
Computer A is associated with an ARPCache 730, computer B is associated with an 
ARPCache 710 and computer C is associated with an ARPCache 720. At the point in 
time associated with Prior Art Fig. 8, the ARPCaches contain the "static" addresses 
associated with the computers. Thus, the ARPCache 730 contains the IP address 1 .2.3.4 
and its associated physical address 1 144. Similarly, the ARPCache 710 contains the IP 
address AJ3.C.D. A.B.C.D and the associated physical address AADD and the 
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ARPCache 720 contains the IP address 5.6.7.8 and the associated physical address 5588. 
In addition to the static addresses, machine A has broadcast its resolved IP/physical 
address pair onto the network by, for example, a conventional ARP broadcast. Thus, the 
ARPCache 710 includes the IP address 1.2.3.4 and the associated physical address 1144, 
where the IP/physical address pair represents the resolved IP/physical address pair 
provided by machine A. ] Similarly, the ARPCache 720 includes the IP address 1 .2.3.4 
and the associated physical address 1 144, where the IP/physical address pair represents 
the resolved IP/physical address pair provided by machine A. 

In addition to the static addresses and the information broadcast by machine A, 
the ARPCache 730 also contains an entry with an IP address A.B.C.D t A.B.C.D and a 
physical address AADD, which represent the resolved IP/physical address of machine B. 
The ARPCache 730 was updated in response to A 7 s attempt to communicate with 
machine B. When A wanted to communicate with B, A sent an ARP request with a 
source IP address of 1 .2.3.4, a source physical address of 1 144, a target IP address of 
AJB-C.P. A.B.CP (which represents the IP address of the machine with which A wants 
to communicate) and a target physical address of 0, representing the fact that machine A 
does not know, but would like to know, the physical address of the machine associated 
with the IP address A.B.C.D. When machine C encountered the ARP request, it 
determined that the IP address did not match its IP address, and thus machine C ignored 
the request. But when machine B encountered the ARP request, it determined that the IP 
address did match its IP address, and thus machine B replied to the ARP request. B 
generated an ARP response with a source IP address A B.C.D. A.B.CD. a source 
physical address AADD (which was used to fill in the ARPCache 730), a target IP 
address of 1.2.3.1. 1 .2.3.4 (the IP address of the machine A that requested the response) 
and a target physical address of 1 144 (the physical address of the machine A that 
requested the response). Machine A receives the reply, detennines that the target IP 
address matches its IP address, and updates its ARPCache based on the reply generated 
by machine B. This conventional method is susceptible to problems generated by 
duplicate addresses. One such problem will be illustrated in connection with Prior Art 
Figs. 8 through 11. 

5 



PAGE 5/16 » RCVD AT 5131/2005 5:12:52 PM [Eastern Daylight Time] * SVR:USPT0-EFXRM/6 < DNIS:8729306 • CSID:216 696 8731 * DURATION (mnws):0«6 



05/31/2005 16:08 FAX 216 696 6731 AMIN, & TUROCY LLP. 

09/965,267 

Thus, turning to Prior Art Fig. 9, a computer network 800 where three computers 
(A, B, C) are networked together is illustrated. None of the three computers has 
announced its presence via an ARP broadcast. The network 800 involves ARP Cache 
tables (ARPCaches). Computer A is associated with an ARPCache 830, computer B is 
associated with an ARPCache 810 and computer C is associated with an ARPCache 820. 
At the point in time associated with Prior Art Fig. 9, the three computers have not yet 
communicated, and have not broadcast their IP/Physical address resolved pairs, and thus 
the ARPCaches contain only the "static" addresses associated with the computers. Thus, 
the ARPCache 830 contains the IP address 1 ,2.3.4 and its associated physical address 
1144. Similarly, the ARPCache 810 contains the IP address A.B.CD. A3.C.D and the 
associated physical address AADD and the ARPCache 820 contains the IP address 
5.6.7.8 and the associated physical address 5588. When the machines attempt to 
communicate the ARPcaches of the communicating machines will be updated. 
Conventionally, such updating is accomplished by employing ARP request/response pairs 
as discussed in association with Prior Art Fig. 8. But such conventional methods can lead 
to duplicate IP address problems, as described below. 

Prior Art Fig. 10 illustrates a network 900 comprising three computers networked 
together (computer A, computer B, computer C). The network 900 includes ARPCaches. 
Computer A is associated with an ARPCache 930, computer B is associated with an 
ARPCache 910 and computer C is associated with an ARPCache 920. At the point in 
time associated with Prior Art Fig. 10, the ARPCaches contain the "static" addresses 
associated with the computers. Thus, the ARPCache 930 contains the IP address 1.2.3.4 
and its associated physical address 1 144. Similarly, the ARPCache 910 contains the IP 
address A.B.C.D. A.B.CD and the associated physical address AADD and the 
ARPCache 920 contains the IP address 5.6.7.8 and the associated physical address 5588. 

ARPCache 930 also contains an entry with an IP address A.B.C.D. A.B.C.D and a 
physical address AADD, which represent the resolved IP/physical address of machine B. 
The ARPCache 930 was updated in response to A's attempt to communicate with 
machine B. When A wanted to communicate with B, A sent an ARP request with a 
source IP address of 1.2.3.4, a source physical address of 1 144, a target IP address of 
A.B.C.D. A.B.C.D (which represents the IP address of the machine with which A wants 
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to communicate) and a target physical address of 0, representing the fact that machine A 
does not know, but would like to know, the physical address of the machine associated 
with the IP address A.B.C.D. When machine C encountered the ARP request, it 
determined that the IP address did not match its IP address, but it also determined that it 
did not have the resolved pair 1.2.3.4. 1.2.3.4 and 1144. Thus, machine C updated its 
ARPCache 920 with such a pair. When machine B encountered the ARP request, it 
determined that the IP address did match its IP address, and thus machine B replied to the 
ARP request. B generated an ARP response with a source IP address A.B.C.D. A.B.CJX 
a source physical address AADD (which was used to fill in the ARPCache 730), a target 
IP address of 1.2.3. 4 . - 1.2.3.4 (the IP address of the machine A that requested the 
response) and a target physical address of 1 144 (the physical address of the machine A 
that requested the response). Machine B similarly determined that it did not have the 
resolved pair 1.2.3. 4 . 1.2.3.4 and 1 144. Thus, machine B updated its ARPCache 910 
with such a pair. 

Please replace the paragraph beginning at page 27, line 29 with the following amended 
paragraph: 

Prior Art Fig. 1 1 illustrates four computers A, B, C, and D networked together. 
Machines A, B and C had previously anived at the state illustrated in Prior Art Fig. 10 by 
the methods described in Prior Art Figs. 8 and 9. Then, machine D came online and 
announced its presence via an ARP broadcast. Note that machine D has an IP address 
±2^A? 1.2.3.4 that is a duplicate of the IP address of machine A. However, the physical 
addresses (2233 and 1 144) do not match. When machine D came online, and announced 
its presence via a conventional ARP broadcast, machines B and C updated their 
ARPCaches. For example, machine B noted the broadcast from, D, determined that it had 
an entry for the IP address 1.2.3. 4 . 1.2.3.4 . but also determined to overwrite that entry, 
and replace the old resolved pair of 1.2.3. 4 . L2.3.4 and 1 144 with the newly encountered 
resolved pair of 4^^ 1.2.3.4 and 2233. Similarly, machine C noted the broadcast from 
D, determined that it had an entry for the IP address 1.2.3.4; 1.2.3.4. but also determined 
to overwrite that entry, and replace the old resolved pair of 1 .2.3. 4 . 1.2.3.4 and 1 144 with 
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the newly encountered resolved pair of k - 2.3. 4 . - 1.2.3.4 and 2233. Such a detennination 
may have been based, for example, on an assumption that the resolved IP 
address/physical address pair changed because an IP component updated its networking 
hardware. Thus, the groundwork for problems associated with a duplicate IP address has 
been laid. Machine A, which also encountered the broadcast from D, did not update its 
ARPCache 1030 since a machine will typically not overwrite its static address. Now, 
when machine A wants to communicate with machine B, machine A sends a message 
with a source IP address of 1.2.3. 4 . 1.2.3 A a source physical address of 1 144, a target IP 
address of A.B.C.D and a target physical address of AADD, Thus, machine B 
determines that it is the intended recipient of the message, and further determines that no 
updating of the ARPCache 1010 is required since all source and destination addresses are 
populated, the message is not an ARP request (e.g., as indicated by values in one or more 
header fields), and ARPCache entries exist for the provided addresses. When machine B 
formats its response to the message from machine A, machine B will populate the one or 
more headers in one or more packets and/or Ethernet frames with the information in the 
ARPCache 1010, which will route the packets and frames to machine D, not to machine 

A. Thus, machine A will not receive the reply packets that it is expecting, and may 
retransmit replacement packets, which may be handled in the same manner by machine 

B. Furthermore, machine D will begin receiving a supply of reply packets that it is not 
expecting, which may include a large number of duplicates in response to the 
retransmissions from machine A. Such a situation can be difficult to debug and remedy. 
As the condition persists, and more packets are generated during the duplicate address 
situation, machines A, B and D become vulnerable to crashes, and other problems. Thus, 
a method to identify and prevent the duplicate IP address situation is still needed. 
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